Use IAM instance profiles for S3 authentication

[kamsz]

Instead of passing key/secret, there should be a possibility to use metadata server to retrieve key/secret from IAM instance profile. Minio supports this approach, but there's no documentation how to configure that and it doesn't work out of the box with s3:s3.amazonaws.com/bucket URL.

Probably requires moving from minio.New to minio.NewWithCredentials.

[fd0]

I need to look into this.

[kamsz]

I've done a very quick test on update-minio-go branch of yours with a small change:

	iam := credentials.NewIAM("")

	client, err := minio.NewWithCredentials(cfg.Endpoint, iam, !cfg.UseHTTP, "")
	if err != nil {
		return nil, errors.Wrap(err, "minio.New")
	}

Works perfectly. Not sure how to support multiple providers - I believe ChainCredentials struct is responsible for that.

[fd0]

Interesting, thanks for trying. What's the parameter string you're passing to NewIAM?

[kamsz]

An empty string as in the example. It should fetch all the required data from metadata server itself.

[fd0]

So, I'd be willing to merge support for IAM in, but I don't have the time to do it (and properly integrate it so that you can still give restic the credentials via the environment variables). I'd be happy to review the code and help integrating it though.

[kamsz]

#1086

[fd0]

thanks!